Skip to content

erp5
erp5
Commit 47c4e226 authored by Rafael Monnerat's avatar Rafael Monnerat
Browse files
Options

Introduce Cerficate Login Document 

See merge request nexedi/erp5!1486
parents 34ee4bdc 563ee3a1
Hide whitespace changes
Inline Side-by-side
Showing with 900 additions and 16 deletions
bt5/erp5_certificate_authority/ActionTemplateItem/portal_types/Certificate%20Login/view.xml 0 → 100644
View file @ 47c4e226
<?xml version="1.0"?>
<ZopeData>
<record id="1" aka="AAAAAAAAAAE=">
<pickle>
<global name="ActionInformation" module="Products.CMFCore.ActionInformation"/>
</pickle>
<pickle>
<dictionary>
<item>
<key> <string>action</string> </key>
<value>
<persistent> <string encoding="base64">AAAAAAAAAAI=</string> </persistent>
</value>
</item>
<item>
<key> <string>categories</string> </key>
<value>
<tuple>
<string>action_type/object_view</string>
</tuple>
</value>
</item>
<item>
<key> <string>category</string> </key>
<value> <string>object_view</string> </value>
</item>
<item>
<key> <string>condition</string> </key>
<value> <string></string> </value>
</item>
<item>
<key> <string>description</string> </key>
<value>
<none/>
</value>
</item>
<item>
<key> <string>icon</string> </key>
<value> <string></string> </value>
</item>
<item>
<key> <string>id</string> </key>
<value> <string>view</string> </value>
</item>
<item>
<key> <string>permissions</string> </key>
<value>
<tuple>
<string>View</string>
</tuple>
</value>
</item>
<item>
<key> <string>portal_type</string> </key>
<value> <string>Action Information</string> </value>
</item>
<item>
<key> <string>priority</string> </key>
<value> <float>1.0</float> </value>
</item>
<item>
<key> <string>title</string> </key>
<value> <string>View</string> </value>
</item>
<item>
<key> <string>visible</string> </key>
<value> <int>1</int> </value>
</item>
</dictionary>
</pickle>
</record>
<record id="2" aka="AAAAAAAAAAI=">
<pickle>
<global name="Expression" module="Products.CMFCore.Expression"/>
</pickle>
<pickle>
<dictionary>
<item>
<key> <string>text</string> </key>
<value> <string>string:${object_url}/CertificateLogin_view</string> </value>
</item>
</dictionary>
</pickle>
</record>
</ZopeData>
bt5/erp5_certificate_authority/DocumentTemplateItem/portal_components/document.erp5_certificate_authority.Person.py
View file @ 47c4e226
from AccessControl import ClassSecurityInfo, Unauthorized, getSecurityManager from AccessControl import ClassSecurityInfo, Unauthorized, getSecurityManager
from erp5.component.document.erp5_version.Person import Person as ERP5Person from erp5.component.document.erp5_version.Person import Person as ERP5Person
from Products.ERP5Type import Permissions
class Person(ERP5Person): class Person(ERP5Person):
security = ClassSecurityInfo() security = ClassSecurityInfo()
security.declarePublic('getCertificate') security.declarePublic('getCertificate')
def _getCertificateLoginDocument(self):
for _erp5_login in self.objectValues(
portal_type=["ERP5 Login"]):
if _erp5_login.getValidationState() == "validated" and \
_erp5_login.getReference() == self.getUserId():
# The user already created a Login document as UserId, so
# So just use this one.
return _erp5_login
for _certificate_login in self.objectValues(
portal_type=["Certificate Login"]):
if _certificate_login.getValidationState() == "validated":
return _certificate_login
certificate_login = self.newContent(
portal_type="Certificate Login",
# For now use UserId as easy way.
reference=self.getUserId()
)
certificate_login.validate()
return certificate_login
def _checkCertificateRequest(self): def _checkCertificateRequest(self):
try: try:
self.checkUserCanChangePassword() self.checkUserCanChangePassword()
...@@ -12,7 +36,7 @@ class Person(ERP5Person): ...@@ -12,7 +36,7 @@ class Person(ERP5Person):
# in ERP5 user has no SetOwnPassword permission on Person document # in ERP5 user has no SetOwnPassword permission on Person document
# referring himself, so implement "security" by checking that currently # referring himself, so implement "security" by checking that currently
# logged in user is trying to get/revoke his own certificate # logged in user is trying to get/revoke his own certificate
user_id = self.Person_getUserId() user_id = self.getUserId()
if not user_id: if not user_id:
raise raise
if getSecurityManager().getUser().getId() != user_id: if getSecurityManager().getUser().getId() != user_id:
...@@ -20,11 +44,11 @@ class Person(ERP5Person): ...@@ -20,11 +44,11 @@ class Person(ERP5Person):
def _getCertificate(self): def _getCertificate(self):
return self.getPortalObject().portal_certificate_authority\ return self.getPortalObject().portal_certificate_authority\
.getNewCertificate(self.Person_getUserId()) .getNewCertificate(self._getCertificateLoginDocument().getReference())
def _revokeCertificate(self): def _revokeCertificate(self):
return self.getPortalObject().portal_certificate_authority\ return self.getPortalObject().portal_certificate_authority\
.revokeCertificateByCommonName(self.Person_getUserId()) .revokeCertificateByCommonName(self._getCertificateLoginDocument().getReference())
def getCertificate(self): def getCertificate(self):
"""Returns new SSL certificate""" """Returns new SSL certificate"""
...@@ -36,3 +60,17 @@ class Person(ERP5Person): ...@@ -36,3 +60,17 @@ class Person(ERP5Person):
"""Revokes existing certificate""" """Revokes existing certificate"""
self._checkCertificateRequest() self._checkCertificateRequest()
self._revokeCertificate() self._revokeCertificate()
security.declareProtected(Permissions.AccessContentsInformation,
'getTitle')
def getTitle(self, **kw):
"""
Returns the title if it exists or a combination of
first name and last name
"""
title = ERP5Person.getTitle(self, **kw)
test_title = title.replace(' ', '')
if test_title == '':
return self.getDefaultEmailCoordinateText(test_title)
else:
return title
bt5/erp5_certificate_authority/PortalTypeAllowedContentTypeTemplateItem/allowed_content_types.xml 0 → 100644
View file @ 47c4e226
<allowed_content_type_list>
<portal_type id="Person">
<item>Certificate Login</item>
</portal_type>
</allowed_content_type_list>
\ No newline at end of file
bt5/erp5_certificate_authority/PortalTypeTemplateItem/portal_types/Certificate%20Login.xml 0 → 100644
View file @ 47c4e226
<?xml version="1.0"?>
<ZopeData>
<record id="1" aka="AAAAAAAAAAE=">
<pickle>
<global name="Base Type" module="erp5.portal_type"/>
</pickle>
<pickle>
<dictionary>
<item>
<key> <string>content_icon</string> </key>
<value>
<none/>
</value>
</item>
<item>
<key> <string>description</string> </key>
<value>
<none/>
</value>
</item>
<item>
<key> <string>group_list</string> </key>
<value>
<tuple>
<string>login</string>
</tuple>
</value>
</item>
<item>
<key> <string>id</string> </key>
<value> <string>Certificate Login</string> </value>
</item>
<item>
<key> <string>init_script</string> </key>
<value>
<none/>
</value>
</item>
<item>
<key> <string>permission</string> </key>
<value>
<none/>
</value>
</item>
<item>
<key> <string>portal_type</string> </key>
<value> <string>Base Type</string> </value>
</item>
<item>
<key> <string>searchable_text_property_id</string> </key>
<value>
<tuple>
<string>reference</string>
</tuple>
</value>
</item>
<item>
<key> <string>type_class</string> </key>
<value> <string>Login</string> </value>
</item>
<item>
<key> <string>type_interface</string> </key>
<value>
<tuple/>
</value>
</item>
<item>
<key> <string>type_mixin</string> </key>
<value>
<tuple/>
</value>
</item>
</dictionary>
</pickle>
</record>
</ZopeData>
bt5/erp5_certificate_authority/PortalTypeWorkflowChainTemplateItem/workflow_chain_type.xml 0 → 100644
View file @ 47c4e226
<workflow_chain>
<chain>
<type>Certificate Login</type>
<workflow>edit_workflow, login_validation_workflow</workflow>
</chain>
</workflow_chain>
\ No newline at end of file
bt5/erp5_certificate_authority/SkinTemplateItem/portal_skins/erp5_certificate_authority.xml
View file @ 47c4e226
...@@ -9,7 +9,18 @@ ...@@ -9,7 +9,18 @@
<item> <item>
<key> <string>_local_properties</string> </key> <key> <string>_local_properties</string> </key>
<value> <value>
<tuple/> <tuple>
<dictionary>
<item>
<key> <string>id</string> </key>
<value> <string>business_template_skin_layer_priority</string> </value>
</item>
<item>
<key> <string>type</string> </key>
<value> <string>float</string> </value>
</item>
</dictionary>
</tuple>
</value> </value>
</item> </item>
<item> <item>
...@@ -18,6 +29,10 @@ ...@@ -18,6 +29,10 @@
<tuple/> <tuple/>
</value> </value>
</item> </item>
<item>
<key> <string>business_template_skin_layer_priority</string> </key>
<value> <float>1.0</float> </value>
</item>
<item> <item>
<key> <string>id</string> </key> <key> <string>id</string> </key>
<value> <string>erp5_certificate_authority</string> </value> <value> <string>erp5_certificate_authority</string> </value>
......
bt5/erp5_certificate_authority/SkinTemplateItem/portal_skins/erp5_certificate_authority/CertificateLogin_view.xml 0 → 100644
View file @ 47c4e226
<?xml version="1.0"?>
<ZopeData>
<record id="1" aka="AAAAAAAAAAE=">
<pickle>
<global name="ERP5 Form" module="erp5.portal_type"/>
</pickle>
<pickle>
<dictionary>
<item>
<key> <string>_bind_names</string> </key>
<value>
<object>
<klass>
<global name="NameAssignments" module="Shared.DC.Scripts.Bindings"/>
</klass>
<tuple/>
<state>
<dictionary>
<item>
<key> <string>_asgns</string> </key>
<value>
<dictionary/>
</value>
</item>
</dictionary>
</state>
</object>
</value>
</item>
<item>
<key> <string>_objects</string> </key>
<value>
<tuple/>
</value>
</item>
<item>
<key> <string>action</string> </key>
<value> <string>Base_edit</string> </value>
</item>
<item>
<key> <string>description</string> </key>
<value> <string></string> </value>
</item>
<item>
<key> <string>edit_order</string> </key>
<value>
<list/>
</value>
</item>
<item>
<key> <string>encoding</string> </key>
<value> <string>UTF-8</string> </value>
</item>
<item>
<key> <string>enctype</string> </key>
<value> <string></string> </value>
</item>
<item>
<key> <string>group_list</string> </key>
<value>
<list>
<string>left</string>
<string>right</string>
<string>center</string>
<string>bottom</string>
<string>hidden</string>
</list>
</value>
</item>
<item>
<key> <string>groups</string> </key>
<value>
<dictionary>
<item>
<key> <string>bottom</string> </key>
<value>
<list/>
</value>
</item>
<item>
<key> <string>center</string> </key>
<value>
<list/>
</value>
</item>
<item>
<key> <string>hidden</string> </key>
<value>
<list/>
</value>
</item>
<item>
<key> <string>left</string> </key>
<value>
<list>
<string>my_translated_portal_type</string>
<string>my_reference</string>
</list>
</value>
</item>
<item>
<key> <string>right</string> </key>
<value>
<list>
<string>my_translated_validation_state_title</string>
</list>
</value>
</item>
</dictionary>
</value>
</item>
<item>
<key> <string>id</string> </key>
<value> <string>CertificateLogin_view</string> </value>
</item>
<item>
<key> <string>method</string> </key>
<value> <string>POST</string> </value>
</item>
<item>
<key> <string>name</string> </key>
<value> <string>Login_view</string> </value>
</item>
<item>
<key> <string>pt</string> </key>
<value> <string>form_view</string> </value>
</item>
<item>
<key> <string>row_length</string> </key>
<value> <int>4</int> </value>
</item>
<item>
<key> <string>stored_encoding</string> </key>
<value> <string>UTF-8</string> </value>
</item>
<item>
<key> <string>title</string> </key>
<value> <string>Login</string> </value>
</item>
<item>
<key> <string>unicode_mode</string> </key>
<value> <int>0</int> </value>
</item>
<item>
<key> <string>update_action</string> </key>
<value> <string></string> </value>
</item>
<item>
<key> <string>update_action_title</string> </key>
<value> <string></string> </value>
</item>
</dictionary>
</pickle>
</record>
</ZopeData>
bt5/erp5_certificate_authority/SkinTemplateItem/portal_skins/erp5_certificate_authority/CertificateLogin_view/my_reference.xml 0 → 100644
View file @ 47c4e226
<?xml version="1.0"?>
<ZopeData>
<record id="1" aka="AAAAAAAAAAE=">
<pickle>
<global name="ProxyField" module="Products.ERP5Form.ProxyField"/>
</pickle>
<pickle>
<dictionary>
<item>
<key> <string>delegated_list</string> </key>
<value>
<list>
<string>description</string>
<string>title</string>
</list>
</value>
</item>
<item>
<key> <string>id</string> </key>
<value> <string>my_reference</string> </value>
</item>
<item>
<key> <string>message_values</string> </key>
<value>
<dictionary>
<item>
<key> <string>external_validator_failed</string> </key>
<value> <string>The input failed the external validator.</string> </value>
</item>
</dictionary>
</value>
</item>
<item>
<key> <string>overrides</string> </key>
<value>
<dictionary>
<item>
<key> <string>field_id</string> </key>
<value> <string></string> </value>
</item>
<item>
<key> <string>form_id</string> </key>
<value> <string></string> </value>
</item>
<item>
<key> <string>target</string> </key>
<value> <string></string> </value>
</item>
</dictionary>
</value>
</item>
<item>
<key> <string>tales</string> </key>
<value>
<dictionary>
<item>
<key> <string>field_id</string> </key>
<value> <string></string> </value>
</item>
<item>
<key> <string>form_id</string> </key>
<value> <string></string> </value>
</item>
<item>
<key> <string>target</string> </key>
<value> <string></string> </value>
</item>
</dictionary>
</value>
</item>
<item>
<key> <string>values</string> </key>
<value>
<dictionary>
<item>
<key> <string>description</string> </key>
<value> <string>The username this person will use to log in the system. The system will check that there isn\'t another user with the same username.</string> </value>
</item>
<item>
<key> <string>field_id</string> </key>
<value> <string>my_string_field</string> </value>
</item>
<item>
<key> <string>form_id</string> </key>
<value> <string>Base_viewFieldLibrary</string> </value>
</item>
<item>
<key> <string>target</string> </key>
<value> <string>Click to edit the target</string> </value>
</item>
<item>
<key> <string>title</string> </key>
<value> <string>User Login</string> </value>
</item>
</dictionary>
</value>
</item>
</dictionary>
</pickle>
</record>
</ZopeData>
bt5/erp5_certificate_authority/SkinTemplateItem/portal_skins/erp5_certificate_authority/CertificateLogin_view/my_translated_portal_type.xml 0 → 100644
View file @ 47c4e226
<?xml version="1.0"?>
<ZopeData>
<record id="1" aka="AAAAAAAAAAE=">
<pickle>
<global name="ProxyField" module="Products.ERP5Form.ProxyField"/>
</pickle>
<pickle>
<dictionary>
<item>
<key> <string>id</string> </key>
<value> <string>my_translated_portal_type</string> </value>
</item>
<item>
<key> <string>message_values</string> </key>
<value>
<dictionary>
<item>
<key> <string>external_validator_failed</string> </key>
<value> <string>The input failed the external validator.</string> </value>
</item>
</dictionary>
</value>
</item>
<item>
<key> <string>overrides</string> </key>
<value>
<dictionary>
<item>
<key> <string>field_id</string> </key>
<value> <string></string> </value>
</item>
<item>
<key> <string>form_id</string> </key>
<value> <string></string> </value>
</item>
<item>
<key> <string>target</string> </key>
<value> <string></string> </value>
</item>
</dictionary>
</value>
</item>
<item>
<key> <string>tales</string> </key>
<value>
<dictionary>
<item>
<key> <string>field_id</string> </key>
<value> <string></string> </value>
</item>
<item>
<key> <string>form_id</string> </key>
<value> <string></string> </value>
</item>
<item>
<key> <string>target</string> </key>
<value> <string></string> </value>
</item>
</dictionary>
</value>
</item>
<item>
<key> <string>values</string> </key>
<value>
<dictionary>
<item>
<key> <string>field_id</string> </key>
<value> <string>my_view_mode_translated_portal_type</string> </value>
</item>
<item>
<key> <string>form_id</string> </key>
<value> <string>Base_viewBaseFieldLibrary</string> </value>
</item>
<item>
<key> <string>target</string> </key>
<value> <string>Click to edit the target</string> </value>
</item>
</dictionary>
</value>
</item>
</dictionary>
</pickle>
</record>
</ZopeData>
bt5/erp5_certificate_authority/SkinTemplateItem/portal_skins/erp5_certificate_authority/CertificateLogin_view/my_translated_validation_state_title.xml 0 → 100644
View file @ 47c4e226
<?xml version="1.0"?>
<ZopeData>
<record id="1" aka="AAAAAAAAAAE=">
<pickle>
<global name="ProxyField" module="Products.ERP5Form.ProxyField"/>
</pickle>
<pickle>
<dictionary>
<item>
<key> <string>delegated_list</string> </key>
<value>
<list/>
</value>
</item>
<item>
<key> <string>id</string> </key>
<value> <string>my_translated_validation_state_title</string> </value>
</item>
<item>
<key> <string>message_values</string> </key>
<value>
<dictionary>
<item>
<key> <string>external_validator_failed</string> </key>
<value> <string>The input failed the external validator.</string> </value>
</item>
</dictionary>
</value>
</item>
<item>
<key> <string>overrides</string> </key>
<value>
<dictionary>
<item>
<key> <string>field_id</string> </key>
<value> <string></string> </value>
</item>
<item>
<key> <string>form_id</string> </key>
<value> <string></string> </value>
</item>
<item>
<key> <string>target</string> </key>
<value> <string></string> </value>
</item>
</dictionary>
</value>
</item>
<item>
<key> <string>tales</string> </key>
<value>
<dictionary>
<item>
<key> <string>field_id</string> </key>
<value> <string></string> </value>
</item>
<item>
<key> <string>form_id</string> </key>
<value> <string></string> </value>
</item>
<item>
<key> <string>target</string> </key>
<value> <string></string> </value>
</item>
</dictionary>
</value>
</item>
<item>
<key> <string>values</string> </key>
<value>
<dictionary>
<item>
<key> <string>field_id</string> </key>
<value> <string>my_translated_workflow_state_title</string> </value>
</item>
<item>
<key> <string>form_id</string> </key>
<value> <string>Base_viewFieldLibrary</string> </value>
</item>
<item>
<key> <string>target</string> </key>
<value> <string>Click to edit the target</string> </value>
</item>
</dictionary>
</value>
</item>
</dictionary>
</pickle>
</record>
</ZopeData>
bt5/erp5_certificate_authority/SkinTemplateItem/portal_skins/erp5_certificate_authority/Login_checkExistence.py 0 → 100644
View file @ 47c4e226
portal_type = context.getPortalType()
# Define backward compatibility for do not duplicate Certificate and ERP5 Login
if portal_type in ("ERP5 Login", "Certificate Login"):
portal_type = ("ERP5 Login", "Certificate Login")
return context.getPortalObject().Base_checkLoginExistence(
portal_type=portal_type,
reference=context.getReference(),
ignore_uid=context.getUid(),
ignore_user_uid=context.getParentValue().getUid(),
)
bt5/erp5_certificate_authority/SkinTemplateItem/portal_skins/erp5_certificate_authority/Login_checkExistence.xml 0 → 100644
View file @ 47c4e226
<?xml version="1.0"?>
<ZopeData>
<record id="1" aka="AAAAAAAAAAE=">
<pickle>
<global name="PythonScript" module="Products.PythonScripts.PythonScript"/>
</pickle>
<pickle>
<dictionary>
<item>
<key> <string>Script_magic</string> </key>
<value> <int>3</int> </value>
</item>
<item>
<key> <string>_bind_names</string> </key>
<value>
<object>
<klass>
<global name="NameAssignments" module="Shared.DC.Scripts.Bindings"/>
</klass>
<tuple/>
<state>
<dictionary>
<item>
<key> <string>_asgns</string> </key>
<value>
<dictionary>
<item>
<key> <string>name_container</string> </key>
<value> <string>container</string> </value>
</item>
<item>
<key> <string>name_context</string> </key>
<value> <string>context</string> </value>
</item>
<item>
<key> <string>name_m_self</string> </key>
<value> <string>script</string> </value>
</item>
<item>
<key> <string>name_subpath</string> </key>
<value> <string>traverse_subpath</string> </value>
</item>
</dictionary>
</value>
</item>
</dictionary>
</state>
</object>
</value>
</item>
<item>
<key> <string>_params</string> </key>
<value> <string></string> </value>
</item>
<item>
<key> <string>id</string> </key>
<value> <string>Login_checkExistence</string> </value>
</item>
</dictionary>
</pickle>
</record>
</ZopeData>
bt5/erp5_certificate_authority/TestTemplateItem/portal_components/test.erp5_certificate_authority.testCertificateAuthorityTool.py
View file @ 47c4e226
...@@ -31,6 +31,7 @@ import os ...@@ -31,6 +31,7 @@ import os
import random import random
import unittest import unittest
from Products.ERP5Type.tests.ERP5TypeTestCase import ERP5TypeTestCase from Products.ERP5Type.tests.ERP5TypeTestCase import ERP5TypeTestCase
from Products.DCWorkflow.DCWorkflow import ValidationFailed
from AccessControl import Unauthorized from AccessControl import Unauthorized
class TestCertificateAuthority(ERP5TypeTestCase): class TestCertificateAuthority(ERP5TypeTestCase):
...@@ -39,8 +40,18 @@ class TestCertificateAuthority(ERP5TypeTestCase): ...@@ -39,8 +40,18 @@ class TestCertificateAuthority(ERP5TypeTestCase):
return "Test Certificate Authority" return "Test Certificate Authority"
def afterSetUp(self): def afterSetUp(self):
self.portal.portal_certificate_authority.certificate_authority_path = \ if getattr(self.portal.portal_types.Person,
os.environ['TEST_CA_PATH'] 'user_can_see_himself', None) is None:
self.portal.portal_types.Person.newContent(
id="user_can_see_himself",
title="The User Himself",
role_name=("Assignee",),
role_base_category_script_id="ERP5Type_getSecurityCategoryFromSelf",
role_base_category="group",
portal_type="Role Information")
if "TEST_CA_PATH" in os.environ:
self.portal.portal_certificate_authority.certificate_authority_path = \
os.environ['TEST_CA_PATH']
def getBusinessTemplateList(self): def getBusinessTemplateList(self):
return ('erp5_base', 'erp5_certificate_authority') return ('erp5_base', 'erp5_certificate_authority')
...@@ -51,6 +62,7 @@ class TestCertificateAuthority(ERP5TypeTestCase): ...@@ -51,6 +62,7 @@ class TestCertificateAuthority(ERP5TypeTestCase):
reference=login, password=login) reference=login, password=login)
person.newContent(portal_type='Assignment').open() person.newContent(portal_type='Assignment').open()
person.newContent(portal_type='ERP5 Login', reference=login).validate() person.newContent(portal_type='ERP5 Login', reference=login).validate()
person.updateLocalRolesOnSecurityGroups()
self.tic() self.tic()
return person.getUserId(), login return person.getUserId(), login
...@@ -59,6 +71,30 @@ class TestCertificateAuthority(ERP5TypeTestCase): ...@@ -59,6 +71,30 @@ class TestCertificateAuthority(ERP5TypeTestCase):
self.loginByUserName(login) self.loginByUserName(login)
person = self.portal.portal_membership.getAuthenticatedMember().getUserValue() person = self.portal.portal_membership.getAuthenticatedMember().getUserValue()
certificate = person.getCertificate() certificate = person.getCertificate()
certificate_login_list = person.objectValues(
portal_type="Certificate Login"
)
self.assertEquals(len(certificate_login_list), 1)
certificate_login = certificate_login_list[0]
self.assertEquals(certificate_login.getReference(), user_id)
self.assertEquals(certificate_login.getValidationState(), "validated")
self.assertTrue('CN=%s' % user_id in certificate['certificate'])
def test_person_duplicated_login(self):
user_id, login = self._createPerson()
self.loginByUserName(login)
person = self.portal.portal_membership.getAuthenticatedMember().getUserValue()
person.newContent(portal_type='ERP5 Login', reference=user_id).validate()
self.tic()
certificate = person.getCertificate()
certificate_login_list = person.objectValues(
portal_type="Certificate Login"
)
# If a erp5_login is already using the User ID, just reuse it for now
self.assertEquals(len(certificate_login_list), 0)
self.assertTrue('CN=%s' % user_id in certificate['certificate']) self.assertTrue('CN=%s' % user_id in certificate['certificate'])
def test_person_revoke_certificate(self): def test_person_revoke_certificate(self):
...@@ -72,6 +108,14 @@ class TestCertificateAuthority(ERP5TypeTestCase): ...@@ -72,6 +108,14 @@ class TestCertificateAuthority(ERP5TypeTestCase):
self.loginByUserName(login) self.loginByUserName(login)
person = self.portal.portal_membership.getAuthenticatedMember().getUserValue() person = self.portal.portal_membership.getAuthenticatedMember().getUserValue()
certificate = person.getCertificate() certificate = person.getCertificate()
certificate_login_list = person.objectValues(
portal_type="Certificate Login"
)
self.assertEquals(len(certificate_login_list), 1)
certificate_login = certificate_login_list[0]
self.assertEquals(certificate_login.getReference(), user_id)
self.assertEquals(certificate_login.getValidationState(), "validated")
self.assertTrue('CN=%s' % user_id in certificate['certificate']) self.assertTrue('CN=%s' % user_id in certificate['certificate'])
person.revokeCertificate() person.revokeCertificate()
...@@ -80,9 +124,56 @@ class TestCertificateAuthority(ERP5TypeTestCase): ...@@ -80,9 +124,56 @@ class TestCertificateAuthority(ERP5TypeTestCase):
self.loginByUserName(login) self.loginByUserName(login)
person = self.portal.portal_membership.getAuthenticatedMember().getUserValue() person = self.portal.portal_membership.getAuthenticatedMember().getUserValue()
certificate = person.getCertificate() certificate = person.getCertificate()
certificate_login_list = person.objectValues(
portal_type="Certificate Login"
)
self.assertEquals(len(certificate_login_list), 1)
certificate_login = certificate_login_list[0]
self.assertEquals(certificate_login.getReference(), user_id)
self.assertTrue('CN=%s' % user_id in certificate['certificate']) self.assertTrue('CN=%s' % user_id in certificate['certificate'])
self.assertEquals(certificate_login.getValidationState(), "validated")
self.assertRaises(ValueError, person.getCertificate) self.assertRaises(ValueError, person.getCertificate)
# Ensure it don't create a second object
certificate_login_list = person.objectValues(
portal_type="Certificate Login"
)
self.assertEquals(len(certificate_login_list), 1)
certificate_login = certificate_login_list[0]
self.assertEquals(certificate_login.getReference(), user_id)
self.assertEquals(certificate_login.getValidationState(), "validated")
def test_person_request_revoke_request_certificate(self):
user_id, login = self._createPerson()
self.loginByUserName(login)
person = self.portal.portal_membership.getAuthenticatedMember().getUserValue()
certificate = person.getCertificate()
certificate_login_list = person.objectValues(
portal_type="Certificate Login"
)
self.assertEquals(len(certificate_login_list), 1)
certificate_login = certificate_login_list[0]
self.assertEquals(certificate_login.getReference(), user_id)
self.assertTrue('CN=%s' % user_id in certificate['certificate'])
self.assertEquals(certificate_login.getValidationState(), "validated")
person.revokeCertificate()
certificate = person.getCertificate()
# Ensure it don't create a second object
certificate_login_list = person.objectValues(
portal_type="Certificate Login"
)
self.assertEquals(len(certificate_login_list), 1)
certificate_login = certificate_login_list[0]
self.assertEquals(certificate_login.getReference(), user_id)
self.assertEquals(certificate_login.getValidationState(), "validated")
def test_person_request_certificate_for_another(self): def test_person_request_certificate_for_another(self):
_, login = self._createPerson() _, login = self._createPerson()
_, login2 = self._createPerson() _, login2 = self._createPerson()
...@@ -91,6 +182,25 @@ class TestCertificateAuthority(ERP5TypeTestCase): ...@@ -91,6 +182,25 @@ class TestCertificateAuthority(ERP5TypeTestCase):
self.loginByUserName(login2) self.loginByUserName(login2)
self.assertRaises(Unauthorized, person.getCertificate) self.assertRaises(Unauthorized, person.getCertificate)
def test_person_duplicated_login_from_another_user(self):
user_id, login = self._createPerson()
person = self.portal.person_module.newContent(portal_type='Person',
reference=str(random.random()), password=login)
person.newContent(portal_type='Assignment').open()
# Try to create a login with other person user_id to cheat the system
person.newContent(portal_type='ERP5 Login', reference=user_id).validate()
self.tic()
self.loginByUserName(login)
person = self.portal.portal_membership.getAuthenticatedMember().getUserValue()
self.assertRaises(ValidationFailed, person.getCertificate)
certificate_login_list = [ i for i in person.objectValues(
portal_type="Certificate Login"
) if i.getValidationState() == "validated"]
self.assertEquals(len(certificate_login_list), 0)
def test_person_revoke_certificate_for_another(self): def test_person_revoke_certificate_for_another(self):
user_id, login = self._createPerson() user_id, login = self._createPerson()
_, login2 = self._createPerson() _, login2 = self._createPerson()
......
bt5/erp5_certificate_authority/bt/template_action_path_list
View file @ 47c4e226
Certificate Login | view
Person | get_certificate Person | get_certificate
Person | revoke_certificate Person | revoke_certificate
\ No newline at end of file
bt5/erp5_certificate_authority/bt/template_portal_type_id_list
View file @ 47c4e226
Certificate Authority Tool Certificate Authority Tool
\ No newline at end of file Certificate Login
bt5/erp5_certificate_authority/bt/template_portal_type_workflow_chain_list 0 → 100644
View file @ 47c4e226
Certificate Login | edit_workflow
Certificate Login | login_validation_workflow
\ No newline at end of file
product/ERP5Security/ERP5ExternalAuthenticationPlugin.py
View file @ 47c4e226
...@@ -41,11 +41,11 @@ manage_addERP5ExternalAuthenticationPluginForm = PageTemplateFile( ...@@ -41,11 +41,11 @@ manage_addERP5ExternalAuthenticationPluginForm = PageTemplateFile(
'www/ERP5Security_addERP5ExternalAuthenticationPlugin', globals(), 'www/ERP5Security_addERP5ExternalAuthenticationPlugin', globals(),
__name__='manage_addERP5ExternalAuthenticationPluginForm') __name__='manage_addERP5ExternalAuthenticationPluginForm')
def addERP5ExternalAuthenticationPlugin(dispatcher, id, title=None, user_id_key='', def addERP5ExternalAuthenticationPlugin(dispatcher, id, title=None, user_id_key='',
REQUEST=None): login_portal_type_list=None, REQUEST=None):
""" Add a ERP5ExternalAuthenticationPlugin to a Pluggable Auth Service. """ """ Add a ERP5ExternalAuthenticationPlugin to a Pluggable Auth Service. """
plugin = ERP5ExternalAuthenticationPlugin(id, title, user_id_key) plugin = ERP5ExternalAuthenticationPlugin(id, title, user_id_key, login_portal_type_list)
dispatcher._setObject(plugin.getId(), plugin) dispatcher._setObject(plugin.getId(), plugin)
if REQUEST is not None: if REQUEST is not None:
...@@ -76,16 +76,28 @@ class ERP5ExternalAuthenticationPlugin(BasePlugin): ...@@ -76,16 +76,28 @@ class ERP5ExternalAuthenticationPlugin(BasePlugin):
'mode':'w', 'mode':'w',
'label':'HTTP request header key where the user_id is stored' 'label':'HTTP request header key where the user_id is stored'
}, },
{'id': 'login_portal_type_list',
'type':'lines',
'mode':'w',
'label': 'List of Login Portal Types to search'
},
) )
+ BasePlugin._properties[:] + BasePlugin._properties[:]
) )
def __init__(self, id, title=None, user_id_key=''): def __init__(self, id, title=None, user_id_key='', login_portal_type_list=None):
#Register value #Register value
self._setId(id) self._setId(id)
self.title = title self.title = title
self.user_id_key = user_id_key self.user_id_key = user_id_key
if login_portal_type_list is None:
# Keep at least one portal type as Login
login_portal_type_list = ["ERP5 Login"]
self.login_portal_type_list = login_portal_type_list
#################################### ####################################
#ILoginPasswordHostExtractionPlugin# #ILoginPasswordHostExtractionPlugin#
#################################### ####################################
...@@ -97,9 +109,10 @@ class ERP5ExternalAuthenticationPlugin(BasePlugin): ...@@ -97,9 +109,10 @@ class ERP5ExternalAuthenticationPlugin(BasePlugin):
if getHeader is None: if getHeader is None:
# use get_header instead for Zope-2.8 # use get_header instead for Zope-2.8
getHeader = request.get_header getHeader = request.get_header
user_id = getHeader(self.user_id_key) external_login = getHeader(self.user_id_key)
if user_id is not None: if external_login is not None:
creds['external_login'] = user_id creds['external_login'] = external_login
creds['login_portal_type'] = self.login_portal_type_list
else: else:
# fallback to default way # fallback to default way
return DumbHTTPExtractor().extractCredentials(request) return DumbHTTPExtractor().extractCredentials(request)
...@@ -125,7 +138,7 @@ class ERP5ExternalAuthenticationPlugin(BasePlugin): ...@@ -125,7 +138,7 @@ class ERP5ExternalAuthenticationPlugin(BasePlugin):
__name__='manage_editERP5ExternalAuthenticationPluginForm') __name__='manage_editERP5ExternalAuthenticationPluginForm')
security.declareProtected(ManageUsers, 'manage_editERP5ExternalAuthenticationPlugin') security.declareProtected(ManageUsers, 'manage_editERP5ExternalAuthenticationPlugin')
def manage_editERP5ExternalAuthenticationPlugin(self, user_id_key, RESPONSE=None): def manage_editERP5ExternalAuthenticationPlugin(self, user_id_key, login_portal_type_list, RESPONSE=None):
"""Edit the object""" """Edit the object"""
error_message = '' error_message = ''
...@@ -135,6 +148,11 @@ class ERP5ExternalAuthenticationPlugin(BasePlugin): ...@@ -135,6 +148,11 @@ class ERP5ExternalAuthenticationPlugin(BasePlugin):
else: else:
self.user_id_key = user_id_key self.user_id_key = user_id_key
if login_portal_type_list == '' or login_portal_type_list is None:
error_message += 'Invalid portal type value '
else:
self.login_portal_type_list = login_portal_type_list
#Redirect #Redirect
if RESPONSE is not None: if RESPONSE is not None:
if error_message != '': if error_message != '':
......
product/ERP5Security/www/ERP5Security_addERP5ExternalAuthenticationPlugin.zpt
View file @ 47c4e226
...@@ -36,6 +36,17 @@ ...@@ -36,6 +36,17 @@
<input type="text" name="user_id_key" size="40" /> <input type="text" name="user_id_key" size="40" />
</td> </td>
</tr> </tr>
<tr>
<td align="left" valign="top">
<div class="form-label">
List of Login Portal Types (One per line)
</div>
</td>
<td align="left" valign="top">
<textarea name="login_portal_type_list:lines" rows="6" cols="35">ERP5 Login
</textarea>
</td>
</tr>
<tr> <tr>
<td colspan="2"> <input type="submit" value="add plugin"/> <td colspan="2"> <input type="submit" value="add plugin"/>
</td> </td>
......
product/ERP5Security/www/ERP5Security_editERP5ExternalAuthenticationPlugin.zpt
View file @ 47c4e226
...@@ -7,7 +7,9 @@ ...@@ -7,7 +7,9 @@
<form action="manage_editERP5ExternalAuthenticationPlugin" method="POST"> <form action="manage_editERP5ExternalAuthenticationPlugin" method="POST">
<table tal:define="user_id_key request/user_id_key|context/user_id_key|string:;"> <table tal:define="user_id_key request/user_id_key|context/user_id_key|string:;
login_portal_type_list_ request/login_portal_type_list|context/login_portal_type_list|string:;
login_portal_type_list python: '\n'.join(login_portal_type_list_)">
<tr> <tr>
<td>HTTP request header key where the user_id is stored</td> <td>HTTP request header key where the user_id is stored</td>
...@@ -16,6 +18,14 @@ ...@@ -16,6 +18,14 @@
tal:attributes="value user_id_key;" /> tal:attributes="value user_id_key;" />
</td> </td>
</tr> </tr>
<tr>
<td>List of Login Portal Types (One per Line)</td>
<td>
<textarea name="login_portal_type_list:lines" rows="6" cols="35"
tal:content="login_portal_type_list">
</textarea>
</td>
</tr>
<tr> <tr>
<td colspan="2"> <td colspan="2">
<input type="submit" value="save"/> <input type="submit" value="save"/>
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7